5165c473207e4cf4ad7a059e7359e5016faa7026a39a786b817028ef8c1bcc8c

Analysis

max time kernel
35s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
16/09/2022, 08:32

Target

converseen-0.9.9.8-1-portable/CORE_RL_MagickWand_.dll
Size

946KB
MD5

f2e5eaa05194d2ac39f1a8970e8eb862
SHA1

5931afed54fd0cb0f1a2c254e40728a8cebc5e23
SHA256

e1f136ab2515f3fbd0808e5f7357ba676b30529cd8ede4924187b5f29583a9b7
SHA512

387d6942217f2c488616f2dc7a01bd18218e27208f16ccda66ab6254f885170043d5050557cd184f3ebcec601f91884b934badc31268221e97596e949a3bc37a
SSDEEP

24576:xzufKiTU6baAJa5n3Z0GRW3KBL/uVRJk:xbF6b8EISLk

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2772	3136	WerFault.exe	76

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 3136	2400	rundll32.exe	76
PID 2400 wrote to memory of 3136	2400	rundll32.exe	76
PID 2400 wrote to memory of 3136	2400	rundll32.exe	76

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_MagickWand_.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\converseen-0.9.9.8-1-portable\CORE_RL_MagickWand_.dll,#1
  2⤵
  PID:3136
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3136 -s 708
    3⤵
    - Program crash
    PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3136 -ip 3136
1⤵
PID:3500